Former Cisco engineer pleads guilty to causing Webex account chaos
1–10 of 17 posts
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#2Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#3What’s going on at Cisco where a departed engineer doesn’t have AWS credentials revoked for a whole 4 months? Hell, the person probably would have had access indefinitely if they had not had done something to make to make Cisco aware of the access.
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#4Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
> Aren't there protections in AWS
For this, in general, the answer is: (1) yes, IAM permissions, and (2) yes, if you configure them, and they often have a cost.
> Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
If Cisco asked, probably. But some things are inherently non-trivial to recover from once you've allowed them to happen. AWS can help, but they aren't magic.
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#5See also this post from 19 hours ago: https://news.ycombinator.com/item?id=24319293
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#6Based on the other thread from yesterday, I wouldn’t jump to conclusions and pin the blame 100% to the former engineer. For such a large company, why the hell did they not put in safeguards to prevent former employees from accessing production environments? The vulnerability wasn’t like a week or two... it was 5 whole months.
I read this as incompetence on Cisco’s part.
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#7Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
> Aren't there protections in AWS For this, in general, the answer is: (1) yes, IAM permissions, and (2) yes, if you configure them, and they often have a cost. > Wouldn't AWS step in and help a company like Cisco if something horrible went wrong? If Cisco asked, probably. But some things are inherently non-trivial to recover from once you've allowed them to happen. AWS can help, but they aren't magic.
Deletion Protection is amazing, but the true way to fix this is to use IAM roles, and groups.
Remove the user that is being terminated from the group and 'voila', it is safe.
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#8When you login at Cisco WebEx, they warn you of criminal liability. However, if you report a security concern at Cisco they treat you like a criminal. Basically, as an employee at Cisco you take on all the liability but they won't protect you from their own negligence.
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#9What’s going on at Cisco where a departed engineer doesn’t have AWS credentials revoked for a whole 4 months? Hell, the person probably would have had access indefinitely if they had not had done something to make to make Cisco aware of the access.
I imagine it was bad communication between the guys handling AWS credentials and IT.
At most companies IT handles logins and credentials for all internal systems. Things like email, vpn, internal sites, and chat. Usually this is all centralized, and when someone leaves IT revokes that user's access to everything.
I'm guessing what happened here was that the engineer got access to AWS manually. Maybe IT wasn't responsible for handling AWS credentials and it was expected that the person who gave him access would revoke it too. Alternatively, the person who gave him might not have gone through the company's regular policies.
Either way, the process in place for handling credentials here clearly didn't work and they got burned in it. Would love to see the internal postmortem here.
Re: Former Cisco engineer pleads guilty to causing Webex account chaos
#10When you login at Cisco WebEx, they warn you of criminal liability. However, if you report a security concern at Cisco they treat you like a criminal. Basically, as an employee at Cisco you take on all the liability but they won't protect you from their own negligence.
I'm guessing that if Cisco has a documented/known security issue they are more liable in case of future lawsuits. If they simply don't know about it then they are less liable. Someone did the math and found that non-liable lawsuits are cheaper than paying to have security issues addressed properly.